Data and privacy

What Heft keeps

Your account

Your email address, your passkeys (only their public part) and the devices you're signed in on.

Company and team

Your company's name, legal form, address, tax number and VAT ID, plus each member's name and email address.

Bank transactions

Only from the accounts you pick when you connect.

Receipts

The original files, unchanged, and what Heft reads from them, such as amount, date and supplier.

From Gmail

Heft checks only a mail's subject, sender and file names, never its text or attachments. If it looks like an invoice, Heft opens it and keeps it if it is one. Heft never downloads any other mail and keeps nothing of it.

Login details

Revolut's read-only access and logins for supplier portals, encrypted with a key of their own.

Answers and chat

How you answered Heft's questions, with the date, and your recent questions in the chat. Other members don't see your chat questions.

Logs

Technical logs, for 30 days.

What the AI sees

For each step the AI model gets only what that step needs: a receipt and the matching payment, say, or your chat question with the figures behind it. The models run on Google Cloud in the EU and on AWS in Frankfurt. Neither Heft nor Google nor Amazon uses your data to train AI.

Who helps

Google Cloud, Frankfurt and EU

Servers, database, files, backups, keys and AI models.

Amazon Web Services, Frankfurt

AI models (Amazon Bedrock).

Enable Banking, Finland

The connection to your bank, read-only.

Resend, EU region

Heft's emails, such as invites and notices.

boxd, Netherlands

Sealed-off browsers that fetch invoices from supplier portals, only if you connect a portal.

These are all the service providers that process your company's data. Google, Amazon and Resend are US companies; they process your data in data centres in the EU. How any transfers are safeguarded is set out in the data processing agreement. If a provider is added, we tell you beforehand.

Keeping and deleting

In Germany you must keep receipts for 8 years. So Heft protects every original file from being changed or deleted for 9 years from upload, even by us. That way a receipt from the start of a year is covered too.

If you cancel, your connections to your bank, Gmail and Revolut end at once, and Heft deletes those login details. Receipts and records stay until the legal period ends. Until then you can still sign in, read everything and export it. After that, Heft deletes them.

If there is a data breach, we tell you without delay.

Your rights

You can ask at any time what data we hold, have wrong details corrected, and export everything. Write to support@namequick.app. Who runs Heft is in the legal notice.